mcp-authprobe runs on your own machine — the client starts it, so there is no endpoint to ping. Last commit 1 Nov 2026.
Active OAuth tests for remote MCP servers you own: tokens, PKCE, redirect_uri, audience, CSRF.
We read the source, 48 min ago · rules 995398eba69f
What this server is able to do. For an MCP server this is often the job itself — a terminal server runs commands because that is what it is for. Listed so you know what you are plugging in, not as an accusation.
const child = spawn(cmd, args as string[], { stdio: "ignore", detached: true, shell: false });
Is this your server and something here is wrong? Tell us — corrections are free and do not require a plan.
We found places where it runs commands, builds paths or queries from values it is given. None of that is a flaw by itself — it becomes one when the code changes, and code changes quietly between releases. We re-read it on every one.
This server runs on your own machine — install it with the package manager and the client starts it for you. Package name taken from the official registry entry.
claude mcp add mcp-authprobe -- npx -y mcp-authprobe
{
"mcpServers": {
"mcp-authprobe": {
"command": "npx",
"args": [
"-y",
"mcp-authprobe"
]
}
}
}
[mcp_servers.mcp-authprobe]
command = "npx"
args = ["-y", "mcp-authprobe"]
{
"mcpServers": {
"mcp-authprobe": {
"command": "npx",
"args": [
"-y",
"mcp-authprobe"
]
}
}
}
{
"servers": {
"mcp-authprobe": {
"type": "stdio",
"command": "npx",
"args": [
"-y",
"mcp-authprobe"
]
}
}
}
Optional settings from the registry entry, left out of the block above:
MCP_AUTHPROBE_SECRET_FILE (Path to the ownership secret (create it with `mcp-authprobe ownership init <host>`). Without a secret, only discovery runs), MCP_AUTHPROBE_SECRET (Ownership secret, if not read from MCP_AUTHPROBE_SECRET_FILE), MCP_AUTHPROBE_CREDENTIALS_FILE (Path to a test grant written by `mcp-authprobe login`, for the refresh token checks. It is consumed by a scan), MCP_AUTHPROBE_ALLOW_PRIVATE (Set to 1 to allow loopback and private targets (local labs only)), MCP_AUTHPROBE_LAB_ORIGINS (Comma-separated lab origins exempt from the ownership proof, e.g. http://127.0.0.1:8080), MCP_AUTHPROBE_TIMEOUT_MS (Per-request timeout in milliseconds (default 10000)).
A/B testing MCP server for pagent: create, run and review A/B tests on your live website.
CLI tool and MCP server that tests MCP servers for spec compliance
Search MCP servers, with our own start-test results, required keys, tools and token cost.
Audit-first test strategy MCP server for repository-native test planning.
Ingeniux CTnP MCP server for personalization, A/B testing, and audience management.
Demo stdio MCP server (tools, resource, prompt) for tinymcp tests—not production use.
9 MCP servers for React/TypeScript — dep auditing, a11y, test gen, and TypeScript enforcement.
Read-only tools to inspect your agent setup: list MCP servers, flag unpinned ones, test a policy.
Answers built from our own checks of this server.